These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A cross-site scripting vulnerability exists in Chamilo LMS up to 1.11.40/2.0.3/3.0.1, specifically in the TicketManager::addProject function of the TicketModule. This issue allows remote attackers to execute a manipulation of the argument Name, leading to cross-site scripting. The exploit has been publicly disclosed and may be utilized. Defenders responsible for Chamilo LMS deployments should assess expos [truncated]
CVE-2026-45143 Chamilo LMS Message Content Stored Cross-Site Scripting. An authenticated low-privilege user can craft message content that executes in an administrator's browser when viewed, potentially exposing session credentials or allowing actions as the administrator. The issue is fixed in version 2.0.1. Reviewing and updating to this version is recommended. This vulnerability is critical, with a CVS [truncated]
CVE-2026-45140 is a critical vulnerability in Chamilo LMS, an open-source learning management system. The issue allows unauthenticated remote attackers to execute arbitrary code on the server and is fixed in version 2.0.1. This vulnerability has a high severity and potential impact on the system, emphasizing the need for defenders to verify exposure and apply the patch promptly. Chamilo LMS instances shou [truncated]
CVE-2026-82535 is a stored cross-site scripting vulnerability in Chamilo LMS before 1.11.42 and 3.0.0. Unauthenticated attackers can inject malicious script payloads into survey answers, which are then rendered in reporting views, potentially executing arbitrary scripts in the browser sessions of teachers or administrators. This vulnerability allows attackers to bypass authorization checks in the survey s [truncated]
CVE-2026-33736 is a vulnerability in Chamilo LMS, a learning management system, that allows any authenticated user, including students, to enumerate all platform users and access their personal information, such as email, phone number, and roles, via a GET request to /api/users. This includes administrator accounts. The vulnerability was fixed in version 2.0.0-RC.3.
CVE-2026-33710 is a vulnerability in Chamilo LMS that allows an attacker to brute-force REST API keys if they know a username and approximate key creation time. The vulnerability is caused by a predictable formula used to generate REST API keys, which is effectively md5(timestamp + user_id*5 - 10000). The vulnerability is fixed in versions 1.11.38 and 2.0.0-RC.3. Defenders responsible for Chamilo LMS depl [truncated]
CVE-2026-33708 is a vulnerability in Chamilo LMS that allows unauthorized access to personal information of any user through the get_user_info_from_username REST API endpoint. The vulnerability is fixed in version 1.11.38. This vulnerability impacts Chamilo LMS instances with user data, particularly those with student information. Defenders should assess exposure and apply the patch to prevent unauthorize [truncated]
CVE-2026-33707 is a critical vulnerability in Chamilo LMS, a learning management system. The default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. This allows an attacker who knows a user's email to compute the reset token and change the victim's password without authentication. The vulnerability is fixed in versions 1.11.38 and 2.0.0-RC.3.
CVE-2026-33706 is a high-severity vulnerability in Chamilo LMS, allowing authenticated users with a REST API key to modify their own status field via the update_user_from_username endpoint. This could allow a student to change their status to Teacher/CourseManager, gaining course creation and management privileges. The vulnerability is fixed in version 1.11.38. Defenders should assess exposure and apply t [truncated]
CVE-2026-33705 is a vulnerability in Chamilo LMS, a learning management system, where Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. This exposure reveals internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. The issue is addressed in version 1.11.38.
CVE-2026-33704 is a Remote Code Execution vulnerability in Chamilo LMS versions prior to 1.11.38. An authenticated user can write arbitrary content to files on the server via the BigUpload endpoint, potentially leading to code execution on Apache configurations where .pht is handled as PHP. This vulnerability has a CVSS score of 7.1 and is considered HIGH severity. The vulnerability exists in the BigUploa [truncated]
CVE-2026-33703 is an Insecure Direct Object Reference (IDOR) vulnerability in Chamilo LMS versions prior to 2.0.0-RC.3. This vulnerability allows any authenticated user to access full personal data and API tokens of arbitrary users by modifying the userId parameter in the /social-network/personal-data/{userId} endpoint, potentially leading to mass disclosure of sensitive user information and credentials.
CVE-2026-33702 is an Insecure Direct Object Reference (IDOR) vulnerability in Chamilo LMS. The vulnerability allows an authenticated user enrolled in a course to overwrite another user's Learning Path progress by modifying the uid parameter in the request. This includes score, status, completion, and time. The vulnerability is fixed in versions 1.11.38 and 2.0.0-RC.3.
CVE-2026-33698 is a critical vulnerability in Chamilo LMS, a learning management system. An unauthenticated attacker can exploit this vulnerability to modify existing files or create new files where allowed by system permissions. The vulnerability is fixed in version 1.11.38. This vulnerability affects portals with the main/install/ directory still present and read-accessible. Defenders should assess expo [truncated]
CVE-2026-33618 debrief: Chamilo LMS has a PlatformConfigurationController::decodeSettingArray() method that uses PHP's eval() to parse platform settings from the database, allowing an attacker with admin access to inject arbitrary PHP code. This code is executed when any user requests /platform-config/list, potentially leading to code execution and unauthorized access. Chamilo LMS administrators should pr [truncated]
CVE-2026-33141 is an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint of Chamilo LMS. This vulnerability allows any authenticated user, including low-privilege students, to read any other user's learning progress, certificates, and gradebook scores for any course without enrollment or supervisory relationship. The issue was fixed in version 2.0.0-RC.3. Defenders respons [truncated]
CVE-2026-32932 is an Open Redirect vulnerability in Chamilo LMS, allowing an attacker to redirect an authenticated administrator to an arbitrary external URL and leak the id_session parameter. The vulnerability is fixed in versions 1.11.38 and 2.0.0-RC.3. Defenders should assess exposure and apply patches to prevent potential redirects and id_session leaks. This vulnerability impacts Chamilo LMS deploymen [truncated]
CVE-2026-32931 Chamilo LMS Unrestricted File Upload Vulnerability. This high-severity vulnerability allows authenticated teachers to upload malicious PHP files by spoofing the Content-Type header, potentially leading to Remote Code Execution as the web server user. The vulnerability is fixed in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3. Affected users should verify and apply patches immediately to preve [truncated]
CVE-2026-32894 is an Insecure Direct Object Reference (IDOR) vulnerability in Chamilo LMS, allowing any authenticated teacher to delete any student's grade result across the platform. The vulnerability is fixed in versions 1.11.38 and 2.0.0-RC.3. Chamilo LMS administrators and teachers should verify their instance's vulnerability and update to a fixed version. This IDOR vulnerability in the gradebook resu [truncated]
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Chamilo LMS prior to 2.0.0-RC.3. An attacker can execute arbitrary JavaScript in an authenticated teacher's browser via the exercise question list admin panel. The vulnerability is due to the pagination code merging all $_GET parameters via array_merge() and outputting the result via http_build_query() directly into HTML href attributes withou [truncated]
Chamilo LMS contains an OS Command Injection vulnerability in the file move function prior to 1.11.38 and 2.0.0-RC.3. Authenticated users with teacher privileges in a course can exploit this vulnerability to execute arbitrary commands as the web server user, potentially leading to unauthorized access, data tampering, and lateral movement within the network. The vulnerability is caused by the insecure use [truncated]
Chamilo LMS contains a Server-Side Request Forgery (SSRF) vulnerability in the Social Wall feature prior to versions 1.11.38 and 2.0.0-RC.3. This allows an authenticated attacker to force the server to make arbitrary HTTP requests to internal services, scan internal ports, and access cloud instance metadata, potentially exposing internal services and cloud instance metadata to unauthorized access and incr [truncated]
Chamilo LMS is vulnerable to session fixation due to user-controlled request parameters being used to set the PHP session ID before loading global bootstrap. This issue affects versions prior to 1.11.38 and 2.0.0-RC.3. The vulnerability allows attackers to fixate a user's session, potentially leading to unauthorized access. Defenders should assess exposure and apply patches if necessary. The CVE record an [truncated]
PatchSiren debrief for CVE-2026-31939, a high-severity vulnerability in Chamilo LMS. The vulnerability is a path traversal issue in main/exercise/savescores.php, allowing for arbitrary file deletion. It was fixed in version 1.11.38. Defenders should assess exposure and apply the patch to prevent potential exploitation attempts. The vulnerability allows for arbitrary file deletion, which can have significa [truncated]
Chamilo LMS has a vulnerability allowing malicious redirects via the /login page's redirect parameter from version 1.11.0 to 2.0-beta.1. This issue is fixed in version 2.0-beta.2. The vulnerability allows attackers to redirect users to malicious sites, potentially leading to phishing attacks or unauthorized access attempts. Defenders should assess exposure and apply the patch to prevent potential security [truncated]